krab1-cc[.]baikal-avtopodbor[.]ru

Analysis of krab1-cc.baikal-avtopodbor.ru indicates a confirmed phishing infrastructure targeting investors in construction projects, as suggested by the page title "krab1 - AT‑инвестиции в строительные проекты." The domain was registered on March 07 2025 through the Russian registrar REGRU‑RU and uses the nameservers ns1.regerey.com and ns2.regerey.com. DNS resolution points to the IP address 193.105.134.30, which belongs to ASN 42237 operated by w1n ltd and is geolocated in Sweden (SE). No TLS certificate is presented, implying the site served only over HTTP, which reduces the attack surface for credential capture but also limits detection via SSL‑pinning mechanisms.

The domain is currently taken offline, preventing live content inspection; however, historical data shows that two of ninety‑five VirusTotal scanners flagged the domain as malicious, and it appears on a single security blocklist, specifically PhishDestroy. Gridinsoft’s trust engine assigns a score of 0 / 100, reinforcing the malicious assessment. Given the limited detection footprint—only two vendor detections and one blocklist entry—defenders should treat the domain as high‑confidence malicious and proactively block both the domain and its hosting IP at perimeter and endpoint layers.

Continuous monitoring of the ASN and associated nameservers is advised to capture any re‑use of the infrastructure for future campaigns. Organizations should also update URL filtering policies to include the domain and consider threat‑intel sharing with peers to reduce exposure to similar phishing attempts.